MCP server

Pallyy runs a remote MCP server that lets AI assistants work in your account. MCP (Model Context Protocol) is the open standard assistants like Claude and ChatGPT use to call tools, so once the server is connected you can ask an assistant to list what's scheduled, draft a week of posts, import images, or pin a reminder to the calendar, and it does the work through Pallyy.

https://app.pallyy.com/mcp

The server exposes the same capabilities as the REST API, under the same rules: every connection can read, writes need scopes, and access can be limited to specific social sets. It is included on every paid plan (Starter, Pro, Agency, and Scale) alongside the API.

What an assistant can do

The server offers 14 tools, one per REST endpoint. See the tool reference for their inputs.

Tools return the same JSON objects the REST endpoints do, so the post set, media, media upload, and note pages describe what an assistant sees.

Every post set the assistant reads or writes can be opened in Pallyy's calendar with a link built from its socialSetId and id, which is the quickest way to review what an assistant scheduled:

https://app.pallyy.com/dashboard/scheduling/calendar/month?set=<socialSetId>&post=<postSetId>

Connect from Claude

Claude on the web and in the desktop app connects through a custom connector:

1. Open Claude's Settings and go to Connectors.
2. Choose Add custom connector.
3. Name it Pallyy, paste https://app.pallyy.com/mcp as the server URL, and add it.
4. Click Connect next to Pallyy. A Pallyy tab opens asking you to sign in and approve the connection, see approving a connection.

Once connected, mention Pallyy in a conversation or enable the connector from the tools menu, and Claude picks the right tool for the request.

Connect from Claude Code

Add the server from the terminal, then sign in from inside a session:

claude mcp add --transport http pallyy https://app.pallyy.com/mcp

Run /mcp in Claude Code, pick Pallyy, and choose to authenticate. Your browser opens the Pallyy consent page, and the tools become available as soon as you approve.

Connect from ChatGPT

ChatGPT connects to remote MCP servers as a connector:

1. Open ChatGPT's Settings and go to Connectors.
2. If you don't see a Create button, turn on Developer mode under Advanced settings first.
3. Click Create, name the connector Pallyy, and paste https://app.pallyy.com/mcp as the MCP server URL.
4. Keep OAuth as the authentication method and save. ChatGPT sends you to Pallyy to approve the connection.

Connect from Cursor

Add Pallyy to Cursor's MCP configuration, either from Cursor Settings > Tools & MCP > New MCP server or by editing ~/.cursor/mcp.json directly:

{
  "mcpServers": {
    "pallyy": {
      "url": "https://app.pallyy.com/mcp"
    }
  }
}

Cursor shows the server as needing login. Click it to open the Pallyy consent page in your browser.

Connect any other client with an API key

Sign-in through the consent page works for clients published by Anthropic, OpenAI, and Cursor, see MCP authorization for why. Any other MCP client can use the server with an API key instead: send the key as a bearer token on every request and skip OAuth entirely.

Authorization: Bearer pallyy_your_api_key

Most clients accept extra headers in their server configuration. In Claude Code, for example:

claude mcp add --transport http pallyy https://app.pallyy.com/mcp \
  --header "Authorization: Bearer pallyy_your_api_key"

An API key carries its own scopes and social set restriction, so an assistant using one can do exactly what the key allows and nothing more.

Approving a connection

Approving a connection creates a grant for that app in your Pallyy account. The consent page shows:

• What the app will be able to do. Viewing your posts, media, and social sets is always included. Write permissions (Edit posts, Publish posts, Upload media, Edit notes) are listed only when the app asked for them, since the client chooses which scopes to request.
• Whether it stays connected. Apps that request offline_access keep working until you disconnect them. Otherwise the connection expires after an hour and the app asks you to connect again.
• Which social sets it can reach. Leave the picker empty to allow every current and future social set, or select specific sets to limit the app to those. Everything outside the selection answers as if it did not exist.

Click Authorize to finish, or Cancel to send the app back with no access. Each app gets one grant per account, so approving it again replaces the previous permissions rather than adding a second connection.

If your plan doesn't include the MCP server, the consent page offers an upgrade instead of the permissions list.

Managing connected apps

Every app you have approved is listed under Settings > Connected Apps with its permissions, the social sets it can reach, when it was connected, and when it was last used. Click Disconnect to revoke an app. It loses access immediately, including any tokens it still holds, and you can reconnect it at any time by approving it again.

Posts created or edited by a connected app show the app's name in the post's history, the same way posts made with an API key show the key's name.

How access works

The MCP server calls the REST API on the assistant's behalf, so the rules on the authentication page apply unchanged:

• Every connection can read. Creating or updating anything needs the matching scope, and scheduling a post that will actually publish needs post-sets:publish on top of post-sets:write.
• A connection limited to specific social sets only sees those sets. Resources in other sets return a 404.
• Plan limits are enforced by the social set's owner subscription: monthly post limits, video and carousel availability, and the media allowance all apply to posts an assistant creates.
• Tool calls count toward the rate limit of 5 requests per second, shared with your API keys.

Errors come back to the assistant as tool errors carrying the API's message, for example Pallyy API error (403): This connected app is missing the required scope: post-sets:publish. The errors page lists every code.

Transport details

The server speaks MCP's Streamable HTTP transport and is stateless: each POST to /mcp carries its own Authorization header and gets a JSON response, there are no sessions to open or close, and GET or DELETE requests answer 405. A request without a bearer token receives a 401 with a WWW-Authenticate header pointing at the authorization metadata, which is how clients discover that the server supports sign-in.